The General Data Protection Regulation (“GDPR”) took direct effect in Luxembourg on 25 May 2018, but since it allows EU Member States latitude in specific areas, Luxembourg passed a new law on 1 August 2018 which repealed the former Luxembourg law on data protection of 2 August 2002: the 1 August 2018 Act concerning the organisation of the CNPD (the Luxembourg Data Protection Authority) and the General Data Protection Regulation (the “Data Protection Act”). The Data Protection Act took effect on 20 August 2018.

The Luxembourg legislator mainly focused on implementing the provisions required under the GDPR, rather than adding further restrictions on the processing of personal data.

The Data Protection Act provisions